category: Utilities provider: Microsoft sectionorder: - Connect - Collect commonfields: id: O365 Defender SafeLinks version: -1 configuration: - name: certificate display: Certificate required: true defaultvalue: type: 9 additionalinfo: A pfx certificate encoded in Base64. displaypassword: Password - Used to generate the certificate section: Connect - name: organization display: Organization required: true defaultvalue: type: 0 additionalinfo: The organization used in app-only authentication. section: Connect - name: app_id display: The application ID from the Azure portal required: true defaultvalue: type: 0 additionalinfo: section: Connect description: Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations. display: O365 Defender SafeLinks name: O365 Defender SafeLinks script: commands: - name: o365-defender-safelinks-policy-list arguments: - name: identity description: "The identity of the Safe Links policy that you want to view. Available identity fields of the policy are: Name, Distinguished name (DN), and GUID." outputs: - contextPath: O365Defender.SafeLinks.AdminDisplayName description: Policy description. type: String - contextPath: O365Defender.SafeLinks.Policy.AllowClickThrough description: Whether users are allowed to click through the original URL. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.CustomNotificationText description: The customized notification text to show to users. type: String - contextPath: O365Defender.SafeLinks.Policy.DeliverMessageAfterScan description: Whether the mail is delivered after Safe Links scanning was completed. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DisableUrlRewrite description: Whether URLs are rewritten (wrapped) in email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DistinguishedName description: Policy distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Policy.DoNotAllowClickThrough description: Whether users can click through the original URLs. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotTrackUserClicks description: Whether user clicks are tracked. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotRewriteUrls description: List of URLs that are not rewritten by Safe Links scanning. type: Unknown - contextPath: O365Defender.SafeLinks.Policy.EnableForInternalSenders description: Whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableOrganizationBranding description: Whether the organization's logo is displayed on Safe Links warning and notification pages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableSafeLinksForTeams description: Whether the Safe Links policy is enabled for Microsoft Teams. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.ExchangeObjectId description: Exchange object ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ExchangeVersion description: The version of the Exchange server. type: String - contextPath: O365Defender.SafeLinks.Policy.Guid description: The GUID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Id description: The ID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Identity description: The identity of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.IsDefault description: Whether the Safe Links policy is the default policy. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsEnabled description: Whether Safe Links protection is enabled for email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsValid description: Whether the Safe Links policy is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.Name description: Policy name. type: String - contextPath: O365Defender.SafeLinks.Policy.ObjectState description: The Safe Links policy state. type: String - contextPath: O365Defender.SafeLinks.Policy.OrganizationId description: The organization ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ScanUrls description: Whether real-time scanning of clicked links in email messages is enabled. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.WhenChanged description: "The date and time the Safe Links policy was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenChangedUTC description: "The date and time (in UTC) the Safe Links policy was modified. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreated description: "The date and time the Safe Links policy was created. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreatedUTC description: "The date and time (in UTC) the Safe Links policy was created. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date description: List the Safe Links policies in your cloud-based organization. - name: o365-defender-safelinks-policy-create arguments: - name: name description: A unique name for the Safe Links policy. required: true - name: admin_display_name description: The description for the policy. - name: custom_notification_text description: The custom notification text to show to users. - name: deliver_message_after_scan description: Whether to deliver email messages only after Safe Links scanning was completed. When true, messages that contain malicious links are not delivered. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: do_not_allow_click_through description: Whether to allow users to click through to the original URL on warning pages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: do_not_rewrite_urls description: Comma-separated list of URLs that are not rewritten by Safe Links scanning. - name: do_not_track_user_clicks description: Whether to track user clicks related to Safe Links protection of links in email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_for_internal_senders description: Whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization.Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_organization_branding description: Whether to display the organization's logo on Safe Links warning and notification pages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_safe_links_for_teams description: Whether to enable Safe Links for Microsoft Teams. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: is_enabled description: Whether to enable Safe Links protection for email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: scan_urls description: Whether to enable or disable real-time scanning of clicked links in email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: use_translated_notification_text description: Whether to use Microsoft Translator to automatically localize the custom notification text that you specified with the CustomNotificationText parameter. Default is false. auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: O365Defender.SafeLinks.AdminDisplayName description: Policy description. type: String - contextPath: O365Defender.SafeLinks.Policy.AllowClickThrough description: Whether users are allowed to click through the original URL. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.CustomNotificationText description: The customized notification text to show to users. type: String - contextPath: O365Defender.SafeLinks.Policy.DeliverMessageAfterScan description: Whether the mail is delivered after Safe Links scanning was completed. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DisableUrlRewrite description: Whether URLs are rewritten (wrapped) in email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DistinguishedName description: Policy distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Policy.DoNotAllowClickThrough description: Whether users can click through the original URLs. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotTrackUserClicks description: Whether user clicks are tracked. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotRewriteUrls description: List of URLs that are not rewritten by Safe Links scanning. type: Unknown - contextPath: O365Defender.SafeLinks.Policy.EnableForInternalSenders description: Whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableOrganizationBranding description: Whether the organization's logo is displayed on Safe Links warning and notification pages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableSafeLinksForTeams description: Whether the Safe Links policy is enabled for Microsoft Teams. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.ExchangeObjectId description: Exchange object ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ExchangeVersion description: The version of the Exchange server. type: String - contextPath: O365Defender.SafeLinks.Policy.Guid description: The GUID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Id description: The ID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Identity description: The identity of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.IsDefault description: Whether the Safe Links policy is the default policy. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsEnabled description: Whether Safe Links protection is enabled for email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsValid description: Whether the Safe Links policy is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.Name description: Policy name. type: String - contextPath: O365Defender.SafeLinks.Policy.ObjectState description: The Safe Links policy state. type: String - contextPath: O365Defender.SafeLinks.Policy.OrganizationId description: The organization ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ScanUrls description: Whether real-time scanning of clicked links in email messages is enabled. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.WhenChanged description: "The date and time the Safe Links policy was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenChangedUTC description: "The date and time (in UTC) the Safe Links policy was modified. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreated description: "The date and time the Safe Links policy was created. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreatedUTC description: "The date and time (in UTC) the Safe Links policy was created. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date description: Create a new Safe Links policy. - name: o365-defender-safelinks-policy-update arguments: - name: name description: A unique name for the Safe Links policy. required: true - name: admin_display_name description: The description for the policy. - name: custom_notification_text description: The custom notification text to show to users. - name: deliver_message_after_scan description: Whether to deliver email messages only after Safe Links scanning was completed. When true, messages that contain malicious links are not delivered. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: do_not_allow_click_through description: Whether to allow users to click through to the original URL on warning pages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: do_not_rewrite_urls description: Comma-separated list of URLs that are not rewritten by Safe Links scanning. - name: do_not_track_user_clicks description: Whether to track user clicks related to Safe Links protection of links in email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_for_internal_senders description: Whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_organization_branding description: Whether to display the organization's logo on Safe Links warning and notification pages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: enable_safe_links_for_teams description: Whether to enable the Safe Links for Microsoft Teams. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: is_enabled description: Whether to enable Safe Links protection for email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: scan_urls description: Whether to enable or disable real-time scanning of clicked links in email messages. Default is false. auto: PREDEFINED predefined: - "true" - "false" - name: use_translated_notification_text description: Whether to use Microsoft Translator to automatically localize the custom notification text that you specified with the CustomNotificationText parameter. Default is false. auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: O365Defender.SafeLinks.AdminDisplayName description: Policy description. type: String - contextPath: O365Defender.SafeLinks.Policy.AllowClickThrough description: Whether users are allowed to click through the original URL. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.CustomNotificationText description: The customized notification text to show to users. type: String - contextPath: O365Defender.SafeLinks.Policy.DeliverMessageAfterScan description: Whether the mail is delivered after Safe Links scanning was completed. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DisableUrlRewrite description: Whether URLs are rewritten (wrapped) in email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DistinguishedName description: Policy distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Policy.DoNotAllowClickThrough description: Whether users can click through the original URLs. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotTrackUserClicks description: Whether user clicks are tracked. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.DoNotRewriteUrls description: List of URLs that are not rewritten by Safe Links scanning. type: Unknown - contextPath: O365Defender.SafeLinks.Policy.EnableForInternalSenders description: Whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableOrganizationBranding description: whether the organization's logo is displayed on Safe Links warning and notification pages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.EnableSafeLinksForTeams description: Whether the Safe Links policy is enabled for Microsoft Teams. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.ExchangeObjectId description: Exchange object ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ExchangeVersion description: The version of the Exchange server. type: String - contextPath: O365Defender.SafeLinks.Policy.Guid description: The GUID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Id description: The ID of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.Identity description: The identity of the Safe Links policy. type: String - contextPath: O365Defender.SafeLinks.Policy.IsDefault description: Whether the Safe Links policy is the default policy. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsEnabled description: Whether Safe Links protection is enabled for email messages. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.IsValid description: Whether the Safe Links policy is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.Name description: Policy name. type: String - contextPath: O365Defender.SafeLinks.Policy.ObjectState description: The Safe Links policy state. type: String - contextPath: O365Defender.SafeLinks.Policy.OrganizationId description: The organization ID. type: String - contextPath: O365Defender.SafeLinks.Policy.ScanUrls description: Whether real-time scanning of clicked links in email messages is enabled. type: Boolean - contextPath: O365Defender.SafeLinks.Policy.WhenChanged description: "The date and time the Safe Links policy was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenChangedUTC description: "The date and time (in UTC) the Safe Links policy was modified. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreated description: "The date and time the Safe Links policy was created. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - contextPath: O365Defender.SafeLinks.Policy.WhenCreatedUTC description: "The date and time (in UTC) the Safe Links policy was created. Time format: YYYY-MM-DDTHH:MM:SSZ." type: Date description: Update a Safe Links policy. - name: o365-defender-safelinks-policy-remove arguments: - name: identity description: "The identity of the Safe Links policy that you want to remove. Available identity fields of the policy are: Name, Distinguished name (DN), and GUID." required: true outputs: [] description: Remove a Safe Links policy. - name: o365-defender-safelinks-rule-list arguments: - name: identity description: "The identity of the Safe Links rule that you want to view. Available identity fields are: Name, Distinguished name (DN), and GUID." - name: state description: The state of the rules. auto: PREDEFINED predefined: - Enabled - Disabled outputs: - contextPath: O365Defender.SafeLinks.Rule.Comments description: Informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment cannot exceed 1024 characters. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Conditions description: The rule condition. type: String - contextPath: O365Defender.SafeLinks.Rule.Description description: The description of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.DistinguishedName description: Rule distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Rule.ExceptIfRecipientDomainIs description: Recipients with email address in the specified domains are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentTo description: Recipients to be excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentToMemberOf description: Recipients in these groups are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Exceptions description: Rule exceptions. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Guid description: The GUID of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Identity description: The identity of the Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.IsValid description: Whether the rule is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Rule.Name description: Rule name. type: String - contextPath: O365Defender.SafeLinks.Rule.ObjectState description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Priority description: The priority of the rule. type: Number - contextPath: O365Defender.SafeLinks.Rule.RecipientDomainIs description: List of domains that are included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.RuleVersion.Build description: Rule build number. type: Number - contextPath: O365Defender.SafeLinks.Rule.RunspaceId description: Run space ID. type: String - contextPath: O365Defender.SafeLinks.Rule.SafeLinksPolicy description: The Safe Links policy that's associated with this Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.SentTo description: List of recipients included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.SentToMemberOf description: List of distribution groups, dynamic distribution groups, or mail-enabled security groups included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.State description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.WhenChanged description: "The date and time the rule was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date description: List Safe Links rules in your cloud-based organization. - name: o365-defender-safelinks-rule-create description: Create a Safe Links rule in your cloud-based organization. arguments: - name: name description: A unique name for the Safe Links rule. required: true - name: safe_links_policy description: The Safe Links policy to associate with this Safe Links rule. required: true - name: comments description: An informative comment for the rule, such as what the rule is used for or how it has changed over time. The length of the comment cannot exceed 1024 characters. - name: enabled description: Whether the rule is enabled. auto: PREDEFINED predefined: - "true" - "false" - name: except_if_recipient_domain_is description: A comma-separated list of exceptions of recipients with email address in the specified domains. isArray: true - name: except_if_sent_to description: A comma-separated list of exceptions of recipients in messages. isArray: true - name: except_if_sent_to_member_of description: A comma-separated list of exceptions of messages sent to members of groups. isArray: true - name: priority description: The priority value for the rule to determines the order of rule processing. A lower integer value indicates a higher priority. The value 0 is the highest priority. Rules cannot have the same priority value. - name: recipient_domain_is description: A comma-separated list of recipients with email address in the specified domains. isArray: true - name: sent_to description: A comma-separated list of recipients in messages. You can use any value that uniquely identifies the recipient. isArray: true - name: sent_to_member_of description: A comma-separated list of messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group. isArray: true outputs: - contextPath: O365Defender.SafeLinks.Rule.Comments description: Informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment cannot exceed 1024 characters. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Conditions description: The rule condition. type: String - contextPath: O365Defender.SafeLinks.Rule.Description description: The description of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.DistinguishedName description: Rule distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Rule.ExceptIfRecipientDomainIs description: Recipients with an email address in the specified domains are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentTo description: Recipients to be excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentToMemberOf description: Recipients in these groups are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Exceptions description: Rule exceptions. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Guid description: The GUID of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Identity description: The identity of the Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.IsValid description: Whether the rule is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Rule.Name description: Rule name. type: String - contextPath: O365Defender.SafeLinks.Rule.ObjectState description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Priority description: The priority of the rule. type: Number - contextPath: O365Defender.SafeLinks.Rule.RecipientDomainIs description: List of domains that are included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.RuleVersion.Build description: Rule build number. type: Number - contextPath: O365Defender.SafeLinks.Rule.RunspaceId description: Run space ID. type: String - contextPath: O365Defender.SafeLinks.Rule.SafeLinksPolicy description: The Safe Links policy that's associated with this Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.SentTo description: List of recipients included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.SentToMemberOf description: List of distribution groups, dynamic distribution groups, or mail-enabled security groups included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.State description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.WhenChanged description: "The date and time the rule was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - name: o365-defender-safelinks-rule-update description: Update a given Safe Links rule. arguments: - name: name description: A unique name for the Safe Links rule. required: true - name: safe_links_policy description: The Safe Links policy to associate with this Safe Links rule. required: true - name: comments description: An informative comment for the rule, such as what the rule is used for or how it has changed over time. The length of the comment cannot exceed 1024 characters. - name: enabled description: Whether the rule is enabled. auto: PREDEFINED predefined: - "true" - "false" - name: except_if_recipient_domain_is description: A comma-separated list of exceptions of recipients with an email address in the specified domains. isArray: true - name: except_if_sent_to description: A comma-separated list of exceptions of recipients in messages. isArray: true - name: except_if_sent_to_member_of description: A comma-separated list of exceptions of messages sent to members of groups. isArray: true - name: priority description: The priority value for the rule to determines the order of rule processing. A lower integer value indicates a higher priority. The value 0 is the highest priority. Rules cannot have the same priority value. - name: recipient_domain_is description: A comma-separated list of recipients with an email address in the specified domains. isArray: true - name: sent_to description: A comma-separated list of recipients in messages. You can use any value that uniquely identifies the recipient. isArray: true - name: sent_to_member_of description: A comma-separated list of messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group. isArray: true outputs: - contextPath: O365Defender.SafeLinks.Rule.Comments description: Informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment cannot exceed 1024 characters. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Conditions description: The rule condition. type: String - contextPath: O365Defender.SafeLinks.Rule.Description description: The description of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.DistinguishedName description: Rule distinguished name (DN). type: String - contextPath: O365Defender.SafeLinks.Rule.ExceptIfRecipientDomainIs description: Recipients with email address in the specified domains are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentTo description: Recipients to be excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.ExceptIfSentToMemberOf description: Recipients in these groups are excluded. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Exceptions description: Rule exceptions. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.Guid description: The GUID of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Identity description: The identity of the Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.IsValid description: Whether the rule is valid. type: Boolean - contextPath: O365Defender.SafeLinks.Rule.Name description: Rule name. type: String - contextPath: O365Defender.SafeLinks.Rule.ObjectState description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.Priority description: The priority of the rule. type: Number - contextPath: O365Defender.SafeLinks.Rule.RecipientDomainIs description: List of domains that are included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.RuleVersion.Build description: Rule build number. type: Number - contextPath: O365Defender.SafeLinks.Rule.RunspaceId description: Run space ID. type: String - contextPath: O365Defender.SafeLinks.Rule.SafeLinksPolicy description: The Safe Links policy that's associated with this Safe Links rule. type: String - contextPath: O365Defender.SafeLinks.Rule.SentTo description: List of recipients included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.SentToMemberOf description: List of distribution groups, dynamic distribution groups, or mail-enabled security groups included in the rule. type: Unknown - contextPath: O365Defender.SafeLinks.Rule.State description: The state of the rule. type: String - contextPath: O365Defender.SafeLinks.Rule.WhenChanged description: "The date and time the rule was modified. Time format: YYYY-MM-DDThh:mm:ss+00:00." type: Date - name: o365-defender-safelinks-detailed-report-get description: Get detailed information about Safe Links results for the last 7 days. Yesterday is the most recent date that you can specify. arguments: - name: start_date description: Start date of the date range in MM-DD-YYYY format. Yesterday is the most recent date that you can specify. You can't specify a date that's older than 7 days. required: true defaultValue: "" predefined: - "" - name: end_date description: End date of the date range in MM-DD-YYYY format. Yesterday is the most recent date that you can specify. You can't specify a date that's older than 7 days. required: true defaultValue: "" predefined: - "" - name: domain description: " filters the results by the domain in the URL." isArray: true defaultValue: "" predefined: - "" - name: app_names description: " filters the results by the app where the link was found. You can enter multiple values separated by commas e.g \"Value1,Value2,...ValueN\"." isArray: true defaultValue: "" predefined: - Email Client - OfficeDocs - Teams auto: PREDEFINED - name: action description: filters the results by action. You can enter multiple values separated by commas e.g Value1,Value2,...ValueN. isArray: true defaultValue: "" predefined: - Allowed - Blocked - ClickedDuringScan - ClickedEvenBlocked - Scanning - TenantAllowed - TenantBlocked - TenantBlockedAndClickedThrough auto: PREDEFINED - name: recipient_address description: " filters the results by the recipient's email address." isArray: true defaultValue: "" predefined: - "" - name: page description: Page number of the results you want to view. Valid input for this parameter is an integer between 1 and 1000. The default value is 1. defaultValue: "" predefined: - "" - name: page_size description: Specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 5000. The default value is 1000. defaultValue: "" predefined: - "" outputs: - contextPath: O365Defender.SafeLinks.DetailedReport.Data.ClickTime description: Time the url was clicked. type: Date - contextPath: O365Defender.SafeLinks.DetailedReport.Data.InternalMessageId description: Internal message id. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.ClientMessageId description: Client message id. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.SenderAddress description: Sender of the email with the clicked URL. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.RecipientAddress description: Receiver of the email with the clicked URL. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.Url description: Clicked URL. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.UrlDomain description: Domain of th clicked URL. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.Action description: Action type. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.AppName description: App where the link was found. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.SourceId description: Source id. type: Unknown - contextPath: O365Defender.SafeLinks.DetailedReport.Data.Organization description: Organization. type: String - contextPath: O365Defender.SafeLinks.DetailedReport.Data.DetectedBy description: "" type: Unknown - contextPath: O365Defender.SafeLinks.DetailedReport.Data.UrlType description: "" type: Unknown - contextPath: O365Defender.SafeLinks.DetailedReport.Data.Flags description: "0: Allowed 1: Blocked 2: ClickedEvenBlocked 3: ClickedDuringScan." type: Number - contextPath: O365Defender.SafeLinks.DetailedReport.ReportId description: "The report id, unique for every run." type: Number - name: o365-defender-safelinks-aggregate-report-get description: general information about Safe Links results for the last 90 days. Yesterday is the most recent date that you can specify. arguments: - name: start_date description: Start date of the date range in MM-DD-YYYY format. Yesterday is the most recent date that you can specify. You can't specify a date that's older than 90 days. required: true defaultValue: "" predefined: - "" - name: end_date description: End date of the date range in MM-DD-YYYY format. Yesterday is the most recent date that you can specify. You can't specify a date that's older than 90 days. required: true defaultValue: "" predefined: - "" - name: app_names description: " filters the results by the app where the link was found. You can enter multiple values separated by commas e.g \"Value1,Value2,...ValueN\"." isArray: true defaultValue: "" predefined: - Email Client - OfficeDocs - Teams auto: PREDEFINED - name: action description: filters the results by action. You can enter multiple values separated by commas e.g Value1,Value2,...ValueN. isArray: true defaultValue: "" predefined: - Allowed - Blocked - ClickedDuringScan - ClickedEvenBlocked - Scanning - TenantAllowed - TenantBlocked - TenantBlockedAndClickedThrough auto: PREDEFINED - name: summerize_by description: Returns totals based on the values you specify. Summarizing reduces the amount of data that's retrieved for the report, and delivers the report faster. By default the summrize is by Action. defaultValue: "" predefined: - Action - App auto: PREDEFINED outputs: - contextPath: O365Defender.SafeLinks.AggregateReport.Data.App description: App where the link was found. type: String - contextPath: O365Defender.SafeLinks.AggregateReport.Data.Action description: Action type. type: String - contextPath: O365Defender.SafeLinks.AggregateReport.Data.MessageCount description: Number of messages with a link. type: Number - contextPath: O365Defender.SafeLinks.AggregateReport.Data.RecipientCount description: Number of recipients of the link. type: Number - contextPath: O365Defender.SafeLinks.AggregateReport.ReportId description: "The report id, unique for every run." type: Number - name: o365-defender-safelinks-atp-policy-get description: Get Advanced Threat Protection policies. outputs: - contextPath: O365Defender.SafeLinks.AtpPolicy.Name description: ATP policy name. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.AdminDisplayName description: ATP policy admin display name. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.EnableATPForSPOTeamsODB description: ATP policy enabled for SPOT teams. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.AllowSafeDocsOpen description: Whether the ATP policy allows safe docs to open. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.EnableSafeDocs description: Whether the ATP policy enables safe docs. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.Identity description: ATP policy ID. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.IsValid description: Is the ATP policy valid. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.WhenCreatedUTC description: When the ATP policy was created in UTC format. type: String - contextPath: O365Defender.SafeLinks.AtpPolicy.WhenChangedUTC description: When the ATP policy was changed in UTC format. type: String - name: o365-defender-safelinks-atp-policy-set description: Set Advanced Threat Protection policy. arguments: - name: allow_safe_docs_open description: Whether users can click through and bypass the Protected View container even when Safe Documents identifies a file as malicious. auto: PREDEFINED predefined: - "true" - "false" - name: enable_atp_spo_teams_odb description: Enable or disable O365 Defender for SharePoint, OneDrive, and Microsoft Teams. auto: PREDEFINED predefined: - "true" - "false" - name: enable_safe_docs description: Enable or disable safe Documents in organizations with Microsoft 365 A5 or Microsoft 365 E5 Security licenses. auto: PREDEFINED predefined: - "true" - "false" runonce: false script: "-" type: powershell dockerimage: demisto/pwsh-exchangev3:1.0.0.10133006 fromversion: 6.0.0 tests: - No Test